What is the CVSS score of EUVD-2026-43656?

EUVD-2026-43656 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JetBrains YouTrack are affected by EUVD-2026-43656?

JetBrains YouTrack self-hosted installations contain a critical authentication bypass vulnerability allowing unauthenticated attackers to gain full administrative access.. A patch is available.

How to fix or mitigate EUVD-2026-43656?

Within 24 hours, inventory all YouTrack self-hosted instances and identify their current versions against the following patch thresholds by release train: 2026.1 must be at least version 13757, 2025.3 at least 148033, 2025.2 at least 148048, 2025.1 at least 148120, 2024.3 at least 148430, and 2024.2 at least 148429. Within 7 days, test the appropriate patched version for your release train in a non-production environment, then deploy to all production instances, prioritizing internet-accessible systems. Within 30 days, confirm all instances are patched, audit administrative access logs for exploitation attempts, reset credentials for all service accounts using YouTrack, and verify no unauthorized administrative accounts were created.

JetBrains YouTrack EUVD-2026-43656

| CVE-2026-62422 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-14 JetBrains

GHSA-cfrg-hc6v-824g

Authentication Bypass Youtrack JetBrains

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (JetBrains) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable missing-auth bypass to admin with low complexity and no auth; impact stays within YouTrack's own authority, so S:U (9.8) rather than the vendor's S:C, pending confirmation of the 'direct database access' precondition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 12, 2026 - 17:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Patch available

Jul 14, 2026 - 13:02 EUVD

Analysis Generated

Jul 14, 2026 - 10:49 vuln.today

CVE Published

Jul 14, 2026 - 10:17 cve.org

CRITICAL 10.0

DescriptionNVD

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

AnalysisAI

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential.

Technical ContextAI

YouTrack is JetBrains' issue-tracking and project-management server, typically self-hosted by engineering organizations and integrated with source control and CI/CD. The root cause is classified as CWE-306, Missing Authentication for a Critical Function: a privileged code path reachable via the application's direct database access is not gated by the normal authentication/authorization checks, so the identity/permission enforcement that should protect administrative operations can be bypassed. The single affected CPE, cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, covers the YouTrack application across all versions below the fixed builds; the vendor's cumulative fix trains for 2024.2, 2024.3, 2025.1, 2025.2, 2025.3 and 2026.1 indicate the flaw spans multiple release branches rather than a single build.

RemediationAI

Vendor-released patch: upgrade to the corresponding fixed build for your release branch - 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (choose the build at or above your current major.minor line). Consult the JetBrains security bulletin at https://www.jetbrains.com/privacy-security/issues-fixed/ for the exact build applicable to your deployment. If immediate patching is not possible, restrict network exposure of the YouTrack server to trusted management networks or VPN only and place it behind an authenticating reverse proxy/WAF to limit reachability, accepting that this breaks external/self-service access; additionally, tightly restrict and monitor direct access to the underlying database host and audit administrative account activity for unexpected privilege use. These are compensating controls only - the flaw is not fully mitigated without the vendor build.